Security

Designed In, Not Bolted On

Your inventory, your clients, and your billing data are some of the most sensitive records your business owns. Here's specifically how Stowley protects them — and how those protections are enforced.

Keeping your data separate

The single most important property of a multi-tenant system: your records are yours, and nobody else's queries can reach them.

Isolation Enforced by the Database

Every organization's data is isolated with PostgreSQL row-level security, and it is enabled on every table in our database without exception. The rules live in the database itself, so a query scoped to the wrong organization returns nothing even if application code has a bug. Isolation is not left to the application layer to remember.

Isolation We Actively Test

Cross-organization isolation and row-level security are covered by an automated integration test suite that runs against a real database on every change. A regression that let one organization read another's records would fail the build before it shipped.

Encryption in Transit and at Rest

All traffic between your browser and Stowley is encrypted with TLS. Data at rest — the database, file uploads, and backups — is encrypted with AES-256 by our managed infrastructure providers.

Backups & Infrastructure

Stowley runs on managed cloud infrastructure with automatic daily database backups, platform monitoring, and automatic failover handled by our hosting providers.

Controlling who gets in

Authentication, permissions, and the client portal — the three doors into your account.

Authentication & Session Handling

Sign-in issues short-lived access tokens that refresh automatically in the background, so a captured token has a narrow useful lifetime. Every server-side operation independently re-verifies the caller's token and confirms their membership in the organization being acted on — the browser is never trusted to assert who it is.

Role-Based Access

Organizations have three roles: owner, admin, and member. Members can create and edit day-to-day records. Deleting records, managing teammates and invitations, changing organization settings, and accessing billing are restricted to admins and owners. Role checks are enforced server-side and in database policies, not just hidden in the interface.

Client Portal Protection

Clients reach their portal with a per-client access code rather than a shared password. Codes are compared using a timing-safe algorithm, and after 10 failed attempts an account is locked for 30 minutes — so codes cannot be discovered by brute force. Portal sessions can only ever read that one client's items, requests, and invoices.

Proving what happened

When you need to reconstruct who did what, the record has to be trustworthy.

Tamper-Evident Audit Trail

Changes to inventory, invoices, service requests, clients, locations, and team membership are recorded with the actor, action, and timestamp. Applications cannot write audit entries directly — database policies block client-side inserts and updates outright. Entries are created only through a privileged database function that derives the actor's identity from their verified session token and rejects any attempt to log an action under someone else's name. Once written, an entry cannot be edited.

Payments Handled by Stripe

Card details are entered directly into Stripe's hosted checkout and payment forms. Card numbers never pass through Stowley's servers and are never stored in our database — we hold only Stripe's tokenized references. Incoming payment webhooks are cryptographically signature-verified before we act on them.

Responsible Disclosure

If you've found a vulnerability, please email security@stowley.com. We acknowledge reports within one business day and work in good faith with researchers to fix issues quickly.

Running a vendor security review, or need answers for a questionnaire? Contact us and we'll work through it with you.

Ready to streamline your warehouse and field operations?

Open a ready-made demo account pre-loaded with sample data to test drive the entire platform, or start your free trial today.

Start A Free Trial

Quick email check-in for a demo. No strings attached